General question about openbgpd and PF

2013-10-29 Thread OCEANET - Cédric BASSAGET
Hi, Simple and general question : Is it a good thing to run PF on an openbgpd server (for security reasons), or should I de-activate PF ? Regards, Cédric -- OCEANET --- [AGENCE DU MANS] 7, rue des Frênes ZAC de la Pointe 72190 SARGE

Re: General question about openbgpd and PF

2013-10-29 Thread Loïc BLOT
Hi, I use PF on some OpenBSD BGP+OSPF routers on Renater (IPv4 + IPv6), it works like a charm. Why this question ? pf rule are simple: pass in quick proto tcp from $bgp_neighbor_1 to $self_peering_1 port 179 pass out quick proto tcp from $self_peering_1 to $bgp_neighbor_1 port 179 -- Best

Re: General question about openbgpd and PF

2013-10-29 Thread Stuart Henderson
On 2013-10-29, OCEANET - Cédric BASSAGET ced...@oceanet.com wrote: Hi, Simple and general question : Is it a good thing to run PF on an openbgpd server (for security reasons), or should I de-activate PF ? I use it, partly to mitigate ssh brute-force, partly so I can easily enable pflow if I

Re: General question about openbgpd and PF

2013-10-29 Thread Sebastian Benoit
OCEANET - C?dric BASSAGET(ced...@oceanet.com) on 2013.10.29 18:27:09 +0100: Hi, Simple and general question : Is it a good thing to run PF on an openbgpd server (for security reasons), or should I de-activate PF ? Yes, in general you should: At least to make sure only traffic from your own